Vulnerability · Published Mar 12, 2025 · Assigned by Bitdefender
CVE-2024-13871Unauthenticated Command Injection in Bitdefender BOX v1
Critical 9.4
In plain English
A critical-severity command injection in BOX v1 from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | BOX v1 | 1.3.11.490 – before 1.3.11.505 |
Weakness: CWE-77 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H